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ABSTRACT 



An automated system and method detects fraudulent trans- 
actions using a predictive model such as a neural network to 
evaluate individual customer accounts and identify poten- 
tially fraudulent transactions based on learned relationships 
among known variables. The system may also output reason 
codes indicating relative contributions of various variables 
to a particular result. The system periodically monitors its 
performance and redevelops the model when performance 
drops below a predetermined level. 

38 Claims, 21 Drawing Sheets 
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FRAUD DETECTION USING PREDICTIVE 
MODELING 

CROSS-REFERENCE TO RELATED 
APPLICATION 

U.S. application Ser. No. 07/814,179, (attorney's docket 
number 726) for "Neural Network Having Expert System 
Functionality", by Curt A. Levey, filed Dec. 30,1991. 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

This invention relates generally to the detection of fraudu- 
lent use of customer accounts and account numbers, includ- 
ing for example credit card transactions. In particular, the 
invention relates to an automated fraud detection system and 
method that uses predictive modeling to perform pattern 
recognition and classification in order to isolate transactions 
having high probabilities of fraud. 

2. Description of the Related Art 

In the following discussion, the term "credit card" will be 
used for illustrative purposes; however, the techniques and 
principles discussed herein apply to other types of customer 
accounts, such as charge cards, bank automated teller 
machine cards and telephone calling cards. 

Credit card issuers conventionally attempt to limit fraud 
losses by immediately closing a customer's account upon 
receiving a report that the card has been lost or stolen. 
Typically, the customer's credit information is then trans- 
ferred to a new account and a new card is issued. This 
procedure is only effective in limiting fraudulent use of lost 
or stolen cards after the loss or theft has been reported to the 
issuer. 

In many cases, however, fraudulent use occurs without the 
knowledge of the cardholder, and therefore no report is made 
to the issuer. This may occur if the customer is unaware that 
the card has been lost or stolen, or if other techniques are 
employed to perpetrate the fraud, such as: use of counterfeit 
cards; merchant fraud; application fraud; or interception of 
credit cards in the mail. In all these situations, the fraudulent 
use may not be detected until (and unless) the cardholder 
notices an unfamiliar transaction on his or her next monthly 
statement and contests the corresponding charge. The con- 
comitant delay in detection of fraud may result in significant 
losses. User fraud, in which the user claims that a valid 
transaction is invalid, is also possible. 

Issuers of credit cards have sought to limit fraud losses by 
attempting to detect fraudulent use before the cardholder has 
reported a lost or stolen card. One conventional technique is 
known as parameter analysis. A parameter analysis fraud 
detection scheme makes a decision using a small number of 
database fields combined in a simple Boolean condition. An 
example of such a condition is: 

if (number of transactions in 24 hours>X) and (more than Y dol- 
lars authorized) then flag this account as high risk 

Parameter analysis will provide the values of X and Y that 
satisfy either the required detection rate or the required false 
positive rate. In a hypothetical example, parameter values of 
X-400 and Y-1000 might capture 20% of the frauds with a 
false positive rate of 200:1, while X«6 and Y-2000 might 
capture 8% of the frauds with a false positive rate of 20:1. 

The rules that parameter analysis provides are easily 
implemented in a database management system, as they are 
restricted to Boolean (e.g., and, or) combinations of condi- 
tions on single variables. 
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Parameter analysis derives rules by examining the single 
variables most able to distinguish fraudulent from non- 
fraudulent behavior. Since only single-variable threshold 
comparisons are used, complex interactions among variables 
arc not captured. This is a limitation that could cause the 
system to discriminate poorly between fraudulent and valid 
account behavior, resulting in low capture rates and high 
false-positive rates. 

Additionally, an effective fraud detection model generally 
requires more variables than conventional parameter analy- 
sis systems can handle. Furthermore, in order to capture new 
fraud schemes, parameter analysis systems must be rede- 
veloped often, and automated redevelopment is difficult to 
implement. 

It is desirable, therefore, to have an automated system that 
uses available information regarding cardholders, 
merchants, and transactions to screen transactions and iso- 
late those which are likely to be fraudulent, and which 
captures a relatively high proportion of frauds while main- 
taining a relatively low false-positive rate. Preferably, such 
a system should be able to handle a large number of 
interdependent variables, and should have capability for 
redevelopment of the underlying system model as new 
patterns of fraudulent behavior emerge. 

SUMMARY OF THE INVENTION 

In accordance with the present invention, there is pro- 
vided an automated system and method for detecting fraudu- 
lent transactions, which uses a predictive model such as a 
neural network to evaluate individual customer accounts and 
identify potentially fraudulent transactions based on learned 
relationships among known variables. These relationships 
enable the system to estimate a probability of fraud for each 
transaction. This probability may then be provided as output 
to a human decision-maker involved in processing the 
transaction, or the issuer may be signaled when the prob- 
ability exceeds a predetermined amount. The system may 
also output reason codes that reveal the relative contribu- 
tions of various factors to a particular result. Finally, the 
system periodically monitors its performance, and redevel- 
ops the model when performance drops below a predeter- 
mined level. 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a block diagram of an implementation of the 
present invention. 

FIG. 2 is a sample system monitor screen which forms 
part of a typical output interface for the present invention. 

FIG. 3 is a sample account selection screen which forms 
part of a typical output interface for the present invention. 

FIG. 4 is a sample transaction analysis screen which 
forms part of a typical output interface for the present 
invention. 

FIG. 5 is a sample customer information screen which 
forms part of a typical output interface for the present 
invention. 

FIG. 6 is a sample analyst response screen which forms 
part of a typical output interface for the present invention. 

FIG. 7 is a flowchart illustrating the major functions and 
operation of the present invention. 

FIG. 8 is a block diagram showing the overall functional 
architecture of the present invention. 

FIG. 9 is a diagram of a single processing element within 
a neural network. 

FIG. 10 is a diagram illustrating hidden processing ele- 
ments in a neural network. 
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FIG. 11 is a flowchart of the pre-processing method of the 
present invention. 

FIG. 12 is a flowchart of the method of creating a profile 
record of the present invention. 

FIG. 13 is a flowchart of the method of updating a profile 
record of the present invention. 

FIG. 14 is a flowchart showing operation of a batch 
transaction processing system according to the present 
invention. 

FIG. 15 is a flowchart showing operation of a semi-real- 
time transaction processing system according to the present 
invention. 

FIG. 16 is a flowchart showing operation of a real-time 
processing system according to the present invention. 

FIG. 17 is a flowchart showing the overall operation of the 
transaction processing component of the present invention. 

FIG. 18 is a flowchart showing the operation of module 
CSCORE of the present invention. 

FIG. 19 is a flowchart showing the operation of Deploy- 
Net of the present invention. 

FIG. 20 is a flowchart showing cascaded operation of the 
present invention. 

FIG. 21 is a portion of a typical CFG model definition file. 

DESCRIPTION OF THE PREFERRED 
EMBODIMENT 

The Figures depict preferred embodiments of the present 
invention for purposes of illustration only. One skilled in the 
art will readily recognize from the following discussion that 
alternative embodiments of the structures and methods illus- 
trated herein may be employed without departing from the 
principles of the invention described herein. 

Referring now to FIG. 1, there is shown a block diagram 
of a typical implementation of a system 100 in accordance 
with the present invention. Transaction information is 
applied to system 100 via data network 105, which is 
connected to a conventional financial data facility 106 
collecting transaction information from conventional 
sources such as human-operated credit-card authorization 
terminals and automated teller machines (not shown). CPU 
101 runs software program instructions, stored in program 
storage 107, which direct CPU 101 to perform the various 
functions of the system. In the preferred embodiment, the 
software program is written in the ANSI C language, which 
may be run on a variety of conventional hardware platforms. 
In accordance with the software program instructions, CPU 
101 stores the data obtained from data network 105 in data 
storage 103, and uses RAM 102 in a conventional manner as 
a workspace. CPU 101, data storage 103, and program 
storage 107 operate together to provide a neural network 
model 108 for predicting fraud. After neural network 108 
processes the information, as described below, to obtain an 
indication of the likelihood of fraud, a signal indicative of 
that likelihood is sent from CPU 101 to output device 104. 

In the preferred embodiment, CPU 101 is a Model 3090 
IBM mainframe computer, RAM 102 and data storage 103 
are conventional RAM, ROM and disk storage devices for 
the Model 3090 CPU, and output device 104 is a conven- 
tional means for either printing results based on the signals 
generated by neural network 108, or displaying the results 
on a video screen using a window-based interface system, or 
sending the results to a database for later access, or sending 
a signal dependent on the results to an authorization system 
(not shown) for further processing. 

Referring now also to FIGS. 2 through 6, there are shown 
sample screens from a conventional window-based interface 
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system (not shown) which forms part of output device 104. 
FIG. 2 shows system monitor 201 that allows a fraud analyst 
or system supervisor to review system performance. System 
monitor 201 shows a cutoff score 202 above which accounts 

5 will be flagged, the number of accounts with scores above 
the cutoff 203, and the fraud score 204 and account number 
205 for a particular account. 

FIG. 3 shows account selection screen 301 that includes 
a scrolling window 302 allowing the analyst to select 

10 high-risk transactions for review, and a set of buttons 303 
allowing the analyst to select further operations in connec- 
tion with the selected transactions. 

FIG. 4 shows transaction analysis screen 401 that allows 
the fraud analyst to examine each high-risk transaction and 

i5 determine appropriate fraud control actions. It includes 
account information 402, fraud score 403, explanations 
derived from reason codes 404 that indicate the reasons for 
fraud score 403, and two scrolling windows 405 and 406 that 
show transaction information for the current day and the past 
seven days 405, and for the past six months 406. 

FIG. 5 shows customer information screen 501 that 
allows the analyst to access customer information, including 
account number 502, customer names 503, best time to call 
504, phone numbers 505, and address 506. It also provides 
access to further functions via on-screen buttons 507. 

FIG. 6 shows analyst response screen 601 that allows the 
analyst to log actions taken to control fraud. It includes a 
series of check boxes 602 for logging information, a com- 
ment box 603, and on-screen buttons 604 allowing access to 

^ other functions. 

Referring now also to FIG. 7, there is shown an overall 
flowchart illustrating the major functions and operation of 
the system 100. First neural network model 108 is trained 
701 using data describing past transactions from data net- 

35 work 105. Then data describing the network model are 
stored 702. Once the model description is stored, system 100 
is able to process current transactions. System 100 obtains 
data for a current transaction 703, and applies the current 
transaction data to the stored network model 704. The model 

40 108 determines a fraud score and reason codes (described 
below), which are output 705 to the user, or to a database, 
or to another system via output device 104. 

Referring now to FIG. 8, the overall functional architec- 
ture of system 100 is shown. System 100 is broken down 

45 into two major components: model development component 
801 and transaction processing component 802. Model 
development component 801 uses past data 804 to build 
neural network 108 containing information representing 
learned relationships among a number of variables. 

50 Together, the learned relationships form a model of the 
behavior of the variables. Although a neural network is used 
in the preferred embodiment, any type of predictive mod- 
eling technique may be used. For purposes of illustration, 
the invention is described here in terms of a neural network. 

55 Transaction processing component 802 performs three 
functions: 1) it determines the likelihood of fraud for each 
transaction by feeding data from various sources 805, 806 
into neural network 108, obtaining results, and outputting 
them 807; 2) when applicable, it creates a record in a profile 

eo database 806 summarizing past transactional patterns of the 
customer, and 3) when applicable, it updates the appropriate 
record in profile database 806. 

Each of the two components of the system will be 
described in turn. 

65 Model Development Component 801 

Neural Networks: Neural networks employ a technique of 
"learning" relationships through repeated exposure to data 
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and adjustment of internal weights. They allow rapid model processed before being fed into the neural network, resulting 

development and automated data analysis. Essentially, such in the creation of a set of fraud-related variables that have 

networks represent a statistical modeling technique that is been empirically determined to form more effective predic- 

capable of building models from data containing both linear tors of fraud than the original historical data, 

and non-linear relationships. While similar in concept to 5 Referring now to FIG. 11, there is shown a flowchart of 

regression analysis, neural networks are able to capture mc pre-processing method of the present invention. Indi- 

nonlinearity and interactions among independent vanables vidual c i cm ents of the flowchart are indicated by designa- 

without pre-specification. In other words, while traditional tions which correspond to module names. The following 

regression analysis requires that nonlinearities and interac- brief description summarizes the processing, 

tions be detected and specified manually, neural networks 10 Da ta used for pre-processing is taken from three databases 

perform these tasks automatically. For a more detailed which contain past data: X ) past transaction database 1101 

description of neural networks, see D. E. Rumelhart et al, ( a]so an "authorization database") containing two 

"Learning Representations by Back-Propagating Errors", years * worth of past transaction data, which may be imple- 

Nature v. 323, pp. 533-36 (1986), and R. Hecht-Nielsen, men ted in the same data base as past data 804; 2) customer 

"Theory of the Backpropagation Neural Network", in Neu- 15 dalabase u0 3 containing customer data; and 3) fraud data- 

rat Networks for Perception, pp. ^ 65-93(1992), the teachings base 1102 which indicates which accounts had fraudulent 

of which are incorporated herein by reference. activity and when the fraudulent activity occurred. 

Neural networks comprise a number of interconnected Module readauth^as 1104 reads transaction data from 

neuron-like processing elements that send data to each other past transaction database 1101. Module matchauth^as 1105 

along connections. The strengths of the connections among 20 samp i es this transaction data to obtain a new transaction data 

the processing elements are represented by weights. Refer- ^ containing all of the fraud accounts and a random ly- 

ring now to FIG. 9, there is shown a diagram of a single selected subset of the non-fraud accounts. In creating the 

processing element 901. The processing element receives new transaction data set, module matchauth^as 1105 uses 

inputs X a , . . . either from other processing elements information from fraud database 1102 to determine which 

or directly from inputs to the system. It multiplies each of its 25 accounts have fraud and do noL For effective network 

inputs by a corresponding weight w x , w 2 , . . . w„ and adds training, it has been found preferable to obtain approxi- 

the results together to form a weighted sum 902. It then m ately ten non-fraud accounts for every fraud account, 

applies a transfer function 903 (which is typically non- Module readex.sas 1106 reads customer data from cus- 

linear) to the weighted sum, to obtain a value Z known as the tomer database 1103. Module matchex.sas 1107 samples this 

state of the element. The state Z is then either passed on to 30 customer data to obtain a new customer data set containing 

another element along a weighted connection, or provided as a ll of me fraud accounts and the same subset of non-fraud 

an output signal. Collectively, states are used to represent acc0 unts as was obtained by module matchauth.sas. In 

information in the short term, while weights represent long- creating the new customer data set, module matchex.sas 

term information or learning. U07 ^ information from fraud database 1102 to deter- 

Processing elements in a neural network can be grouped 35 mine which acc0llnts have &aud ^ wmc h do not. 

into three categories: input processing elements (those Module mxmerge.sas 1108 merges all of the data sets 

which receive input data values); output processing elements obtained by modules matchauth.sas 1105 and matchex.sas 

(those which produce output values); and hidden processing 1107 Module genau^as 1109 subdivides the merged data set 

elements (all others). The purpose of hidden processing mt0 ^ bs&ts of monthly data. 

elements is to allow the neural network to build intermediate w Module gensamp.sas 1112 samples the data set created by 
representations that combine input data in ways that help the module mxmer ge.sas 1108 and subdivided by genau.sas 
model leam the desired mapping with greater accuracy. ^9 ^d creates a new data set called sample.ssd where 
Referring now to FIG. 10, there is shown a diagram illus- each represents a particular account on a particular 
trating the concept of hidden processing elements. Inputs day ^ transaction activity. Module gensamp.sas 1112 
1001 are supplied to a layer of input processing elements 45 determ i ocs wn i ca records are fraudulent using information 
1002. The outputs of the input elements are passed to a layer from fraud databasc u 0 2. Module gensamp.sas 1112 pro- 
of hidden elements 1003. Typically there are several such vides a of authorization days, as follows: From the 
layers of hidden elements. Eventually, hidden elements pass da tabase of all transactions, a set of active account-days is 
outputs to a layer of output elements 1004, and the output created by removing multiple transactions for the same 
elements produce output values 1005. 50 customer on the same day. In the set of active account^days, 
Neural networks learn from examples by modifying their each account day is assigned a "draft number" from 0 to 1. 
weights. The "training'' process, the general techniques of This draft number is assigned as follows: If the account-day 
which are well known in the art, involves the following ^ QOn -fraudulent, then the draft number is set to a random 
sle P s: number between 0 and 1. If the account-day is fraudulent 

1) Repeatedly presenting examples of a particular input/ 55 a nd it lies on the first or second day of fraud, then the draft 
output task to the neural network model; number is set to 0. Otherwise, it is set to 1. Then, the 25,000 

2) Comparing the model output and desired output to account-days with the smallest draft numbers are selected 
measure error; and for inclusion in sample.ssd. Thus, all fraudulent account- 

3) Modifying model weights to reduce the error. days (up to 25,000) plus a sample of non-fraudulent account - 
This set of steps is repeated until further iteration fails to 60 days are included in sample.ssd. 

decrease the error. Then, the network is said to be "trained." Module rolll5.sas 1113 generates a 15-day rolling win- 
Once training is completed, the network can predict out- dowofdata. This data has multiple records for each account - 
comes for new data inputs. day listed in samplcssd. The current day and 14 preceding 

Fraud-Related Variables: In the present invention, data days are listed for each sample account, 

used to train the model are drawn from various database files 65 Module roll 15to7.sas 1117 takes the rolllS data set and 

containing historical data on individual transactions, filters out days eight to 15 to produce roll7, a 7-day rolling 

merchants, and customers. These data are preferably pre- window data set 1119. Days eight to 15 are ignored. Module 
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genrolv^as 1118 generates input variables for a rolling 
window of the previous 15 days of transactions. It processes 
a data set with multiple and variable numbers of records per 
account and produces a data set with one record per account. 
The result is called rollv_ssd. 

Module roM5tol.sas 1114 takes the rolUS data set and 
niters out days except the current day to produce rolll. 
Module geocurv.sas 1115 uses rolll to generate current day 
variables 1116 describing transactions occurring during the 
current day. 

Module genprof.sas generates profile variables which 
form the profile records 1111. 

Module merge.sas 1120 combines the profile records 
1111, 1-day variables 1116, and 7-day variables 1119 and 
generates new fraud-related variables, as listed below, from 
the combination. It also merges rollv.ssd with the sample- 
filtered profile data sets to produce a single data set with both 
profile and rolling window variables: The result is called the 
modln2 data set 1121 (also called the "training set"), which 
contains the fraud-related variables needed to train the 
network- Scaler module 1122 scales the variables such that 
the mean value for each variable in the scaled training set is 
0.0 and the standard deviation is 1.0, to create scaled 
modln2 data set 1123. 

Many fraud-related variables may be generated using 
variations of the pre-processing method described above. 
Fraud-related variables used in the preferred embodiment 
include: 

Customer usage pattern profiles representing time-of-day 

and day-of-week profiles; 
Expiration date for the credit card; 
Dollar amount spent in each SIC (Standard Industrial 

Classification) merchant group category during the 

current day; 
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Percentage of dollars spent by a customer in each SIC 

merchant group category during the current day; 
Number of transactions in each SIC merchant group 
5 category during the current day; 

Percentage of number of transactions in each SIC mer- 
chant group category during the current day; 

Categorization of SIC merchant group categories by fraud 
iq rate (high, medium, or low risk); 

Categorization of SIC merchant group categories by cus- 
tomer types (groups of customers that most frequently 
use certain SIC categories); 

Categorization of geographic regions by fraud rate (high, 
15 medium, or low risk); 

Categorization of geographic regions by customer types; 

Mean number of days between transactions; 

Variance of number of days between transactions; 

20 J 

Mean time between transactions in one day; 

Variance of time between transactions in one day; 

Number of multiple transaction declines at same mer- 
^ chant; 

Number of out-of-state transactions; 

Mean number of transaction declines; 

Year-to-date high balance; 
30 Transaction amount; 

Transaction date and time; 

Transaction type. 

Additional fraud-related variables which may also be 
considered are listed below: 



Current Day Cardholder Fraud Related Variables 



b weekend current day boolean indicating current date time considered weekend 

cavapvdl current day mean dollar amount for an approval 

cavapvdl current day mean dollar amount for an approval 

cavaudl current day mean dollars per auth across day 

ccosodoni current day cosine of the day of month i.e. cos(day ((datepart(cst_dt) * &TWOPI)/30)); 

ccoscdow current day cosine of the day of week Le. cos(weekday ((date pa rt(cs t_dt) * &TWOPI)/7)); 

ccoscmoy current day cosine of the month of year Le. cos(month ((datepart(csL_dt) * &TWOPI)/12)); 

cdom current day day of month 

cdow current day day of week 

chdzip current cardholder zip 

chibal current day high balance 

chidcapv current day highest dollar amt on a single cash approve 

chidedec current day highest dollar amt on a single cash decline 

chidmapv current day highest dollar amt on a single merch approve 

chidmdec current day highest dollar amt on a single merch decline 

chidsapv current day highest dollar amount on a single approve 

chidsau current day highest dollar amount on a single auth 

chidsdec current day highest dollar amount on a single decline 

cmoy current day month of year 

cratdcau current day ratio of declines to auths 

csincdom current day sine of the day of month Le. sin(day ((datepart(cst_dt) • &TWOPI)/30)); 

csincdow current day sine of the day of week Le. sin(weekday ((datepart(cst__dt) * &TWOPf)/7)), 

csincmoy current day sine of the month of year Le: sin(month ((datepart(cs_dt) • &TWOPI)/12)); 

cst_dt current day est datetime derived from zip code and CST auth lime 

ctdapv current day total dollars of approvals 

ctdau current day total dollars of auths 

ctdcsapv current day total dollars of cash advance approvals 

ctdesdec current day total dollars of cash advance declines 

ctddec current day total dollars of declines 

ctdmrapv current day total dollars of merchandise approvals 

ctdmrdec current day total dollars of merchandise declines 

ctnapv current day total number of approves 

ctnau current day total number of auths 

ctnaulOd current day number of auths in day <=510 
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-continued 



ctnaudy 
etnesapv 
etnesapv 
etnesdec 
ctndec 

CulfflrEpV 

ctnmidec 

ctnsdapv 

ctnwdaft 

ctnwdapv 

ctnwdevc 

ctawdmoT 

ctnwdnit 

ctnweaft 

ctnwcapv 

ctnweeve 

ctnwemor 

etnwenit 

currbal 

cvraudl 

czratel 

czratc2 

czrate3 

czrate4 

czrateS 

czratt6 

czrnte7 

czratcS 

ctdsfaOl 

ctdsfa02 

ctdsfa03 

ctdsfa04 

ctdsfa05 

ctdsfa06 

ctdsfa07 

ctdsfa08 

ctdsfa09 

ctdsfalO 

ctdsfall 

ctdsraOl 

ctdsra02 

ctdsra03 

ctdsra04 

ctdsra05 

ctdsra06 

ctdsra07 

ctdsvaOl 

ctdsva02 

ctdsva03 

ctdsva04 

ctdsvaOS 

ctdsva06 

ctdsva07 

ctdsva08 

ctdsva09 

ctdsvalO 

ctdsvall 

ctnsfaOl 

ctnsfa02 

ctnsfa03 

ctnsfa04 

ctnsfaOS 

ctnsfa06 

ctnsfa07 

ctnsfs08 

ctnsfa09 

ctnsfalO 

ctnsfall 

ctnsraOl 

ctnsra02 

ctnsra03 

ctnsra04 

ctnsra05 

ctnsra06 

ctnsra07 

ctnsvaOl 

ctnsva02 

ctnsva03 

ctnsvatM 

ctnsvaOS 



current 
current 
current 
current 
current 
correal 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
correct 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 
current 



total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 


total 


number 


of 



day current balance 

day variance of dollars per auth across day 
day zip risk group 1 'Zip very high fraud rate' 
day zip risk group 2 'Zip high fraud rate' 
day zip risk group 3 'Zip medium high fraud rate' 
day zip risk group 4 'Zip medium fraud rate' 
day zip risk group 5 'Zip medium low fraud rate' 
day zip risk group 6 'Zip low fraud rate' 
day zip risk group 7 'Zip very low fraud rate' 
day zip risk group 8 'Zip unknown fraud rate' 
day total dollars of transactions in SIC factor group 01 
day total dollars of transactions in SIC factor group 02 
day total dollars of transactions in SIC factor group 03 
day total dollars of transactions in SIC factor group 04 
day total dollars of transactions in SIC factor group OS 
day total dollars of transactions in SIC factor group 06 
day total dollars of transactions in SIC factor group 07 
day total dollars of transactions in SIC factor group OS 
day total dollars of transactions in SIC factor group 09 
day total dollars of transactions in SIC factor group 10 
day total dollars of transactions in SIC factor group 11 
day total dollars of transactions in SIC fraud rate group 01 
day total dollars of transactions in SIC fraud rate group 02 
day total dollars of transactions in SIC fraud rate group 03 
day total dollars of transactions in SIC fraud rate group 04 
day total dollars of transactions in SIC fraud rate group OS 
day total dollars of transactions in SIC fraud rate group 06 
day total dollars of transactions in SIC fraud rate group 07 
day total dollars in SIC VISA group 01 
day total dollars in SIC VISA group 02 
day total dollars in SIC VISA group 03 
day total dollars in SIC VISA group 04 
day total dollars in SIC VISA group 05 
day total dollars in SIC VISA group 06 
day total dollars in SIC VISA group 07 
day total dollars in SIC VISA group 08 
day total dollars in SIC VISA group 09 
day total dollars in SIC VISA group 10 
day total dollars in SIC VISA group 11 
day total number of transactions in SIC factor group 01 
day total number of transactions in SIC factor group 02 
day total number of transactions in SIC factor group 03 
day total number of transactions in SIC factor group 04 
day total number of transactions in SIC factor group 05 
day total number of transactions in SIC factor group 06 
day total number of transactions in SIC factor group 07 
day total number of transactions in SIC factor group 08 
day total number of transactions in SIC factor group 09 
day total number of transactions in SIC factor group 10 
day total number of transactions in SIC factor group 11 
day total number of transactions in SIC fraud rate group 01 
day total number of transactions in SIC fraud rate group 02 
day total number of transactions in SIC fraud rate group 03 
day total number of transactions in SIC fraud rate group 04 
day total number of transactions in SIC fraud rate group 05 
day total number of transactions in SIC fraud rate group 06 
day total number of transactions in SIC fraud rate group 07 
day total number in SIC VISA group 01 
day total number in SIC VISA group 02 
day total number in SIC VISA group 03 
day total number in SIC VISA group 04 
day total number in SIC VISA group 05 
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-continued 

ctnsva06 current day total number in SIC VISA group 06 

ctnsva07 current day total number in SIC VISA group 07 

ctnsvaOS current day total number in SIC VISA group 08 

ctnsva09 current day total number in SIC VISA group 09 

ctnsvalO current day total number in SIC VISA group 10 

ctnsvall current day total number in SIC VISA group 11 

7 Day Cardholer Fraud Related Variables 



raudymdy 7 day ratio of aulh days over number of days in the window 

ravapvdl 7 day mean dollar amount for an approval 

ravaudl 7 day mean dollars per autb across window 

rddapv 7 day mean dollars per day of approvals 

rddapv2 7 day mean dollars per day of approvals on days with auths 

rddau 7 day mean dollars per day of auths on days with auths 

rddauall 7 day mean dollars per day of auths on all days in window 

rddcsapv 7 day mean dollars per day of cash approvals 

rddesdec 7 day mean dollars per day of cash declines 

rdddec 7 day mean dollars per day of declines 

rdddec2 7 day mean dollars per day of declines on days with auths 

rddmrapv 7 day mean dollars per day of merchandise approvals 

rddmrdec 7 day mean dollars per day of merchandise declines 

rdnapv 7 day mean number per day of approvals 

rdnau 7 day mean number per day of auths on days with auths 

rdnauall 7 day mean number per day of auths on all days in window 

rdncsapv 7 day mean number per day of cash approvals 

rdncsdec 7 day mean number per day of cash declines 

rdndec 7 day mean number per day of declines 

rdnmrapv 7 day mean number per day of merchandise approvals 

rdnmrdec 7 day mean number per day of merchandise declines 

rdnsdap2 7 day mean number per day of approvals on same day of week calculated only for those 

days which had approvals 

rdnsdapv 7 day mean number per day of approvals on same day of week as current day 

rdnwdaft 7 day mean number per day of weekday afternoon approvals 

rdnwdapv 7 day mean number per day of weekday approvals 

rdnwdeve 7 day mean number per day of weekday evening approvals 

rdnwdmor 7 day mean number per day of weekday morning Approvals 

rdnwdnit 7 day mean number per day of weekday night approvals 

rdnweaft 7 day mean number per day of weekend afternoon approvals 

rdnweapv 7 day mean number per day of weekend approvals 

rdnweeve 7 day mean number per day of weekend evening approvals 

rdnwemor 7 day mean number per day of weekend morning approvals 

rdnwenit 7 day mean number per day of weekend night approvals 

rhibal 7 day highest window balance 

rhidcapv 7 day highest dollar amt on a single cash approve 

rhidedec 7 day highest dollar amt on a single cash decline 

rhidmapv 7 day highest dollar amt on a single merch approve 

rhidmdec 7 day highest dollar amt on a single merch decline 

rhidsapv 7 day highest dollar amount on a single approve 

rhidsam 7 day highest dollar amount on a single auth 

rhidsdec 7 day highest dollar amount on a single decline 

rhidtapv 7 day highest total dollar amount for an approve in a single day 

rhidtau 7 day highest total dollar amount for any auth in a single day 

rhidtdec 7 day highest total dollar amount for a decline in a single day 

rhinapv 7 day highest number of approves in a single day 

rhinau 7 day highest number of auths in a single day 

rhindec 7 day highest number of declines in a single day 

rnaudy 7 day number of days in window with any auths 

rnausd 7 day number of same day of week with any auths 

mauwd 7 day number of weekdays days in window with any auths 

rnauwe 7 day number of weekend days in window with any auths 

rncsaudy 7 day number of days in window with cash auths 

nrairaudy 7 day number of days in window with merchant auths 

rtdapv 7 day total dollars of approvals 

rtdau 7 day total dollars of auths 

rtdcsapv 7 day total dollars of cash advance approvals 

rtdesdec 7 day total dollars of cash advance declines 

rtddec 7 day total dollars of declines 

rtdmrapv 7 day total dollars of merchandise approvals 

rtdmrdec 7 day total dollars of merchandise declines 

rtnapv 7 day total number of approvals 

rtnapvdy 7 day total number of approvals in a day 

rtnan 7 day total number of auths 

rtnaulOd 7 day number of auths in window <- $10 

rtncsapv 7 day total number of cash advance approvals 

rtnesdec 7 day total number of cash advance adeclines 

rtndec 7 day total number of declines 

rtnmrapv 7 day total number of merchandise approvals 

rtnmrdec 7 day total number of merchandise declines 

rtnsdapv 7 day total number of approvals on the same day of week as current day 

rtnwdaft 7 day total number of weekday afternoon approvals 
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rtnwdapv 

rtnwdcvc 

rtnwdmor 

rtnwdnit 

rtnweaft 

itnwcapv 

rtnwceve 

itnwemor 

ituwenii 

rvraudJ 



7 day total number of weekday approvals 

7 day total number of weekday evening approval* 

7 day total number of weekday morning approvals 

7 day total number of weekday night approvals 

7 day total number of weekend afternoon approvals 

7 day total number of weekend approvals 

7 day total number of weekend evening approvals 

7 day total number of weekend morning approvals 

7 day total number of weekend eight approvals 

7 day variance of dollars per aulh across window 

Profile Cardholder Fraud Related variables 



paudymdy profile ratio of auth days over number of days in the month 

pavapvdl profile mean dollar amount for an approval 

pavaudl profile mean dollars per auth across month 

pchdzip profile the zip of the cardholder 

pdbm profile value of 'date became member' at time of last profile update 

pddapv profile daily mean dollars of approvals 

pddapv2 profile daily mean dollars of approvals on days with auths 

pddau profile daily mean dollars of auths on days with auths 

pddau30 profile daily mean dollars of auths on all days in month 

pddcsapv profile daily mean dollars of cash approvals 

pddesdec profile daily mean dollars of cash declines 

pdddec profile daily mean dollars of declines 

pdddec2 profile daily mean dollars of declines on days with auths 

pddmrapv profile daily mean dollars of merchandise approvals 

pddmrdec profile daily mean dollars of merchandise declines 

pdnapv profile daily mean number of approvals 

pdnau profile daily mean number of auths on days with auths 

pdnau30 profile daily mean number of auths on all days in month 

pdncsapv profile daily mean number of cash approvals 

pdncsdec profile daily mean number of cash declines 

pdndec profile daily mean number of declines 

pdnmrapv profile daily mean number of merchandise approvals 

pdnmrdec profile daily mean number of merchandise declines 

pdnwlap2 profile mean number of approvals on Sundays which had auths 

pdnwlapv profile mean number of approvals on Sundays (day 1 of week) 

pdnw2ap2 profile mean number of approvals on Mondays which had auths 

pdnw2apv profile mean number of approvals on Mondays (day 2 of week) 

pdnw3ap2 profile mean number of approvals on Tuesdays which had auths 

pdnw3apv profile mean number of approvals on Tuesdays (day 3 of week) 

pdnw4ap2 profile mean number of approvals on Wednesdays which had auths 

pdnw4apv profile mean number of approvals on Wednesdays (day 4 of week) 

pdnw5ap2 profile mean number of approvals on Thursdays which had auths 

pdnw5apv profile mean number of approvals on Thursdays (day 5 of week) 

pdnw6ap2 prdfilc mean number of approvals on Fridays which had auths 

pdnwoapv profile mean number of approvals on Fridays (day 6 of week) 

pdnw7ap2 profile mean number of approvals on Saturdays which had auths 

pdnw7apv profile mean number of approvals on Saturdays (day 7 of week) 

pdnwdaft profile daily mean number of weekday afternoon approvals 

pdnwdapv profile daily mean number of weekday approvals 

pdnwdeve profile daily mean number of weekday evening approvals 

pdnwdmor profile daily mean number of weekday morning approvals 

pdnwdnit profile daily mean number of weekday night approvals 

pdnweaft profile daily mean number of weekend afternoon approvals 

pdnweapv profile daily mean number of weekend approvals 

pdnweeve profile daily mean number of weekend evening approvals 

pdnwemor profile daily mean number of weekend morning approvals 

pdnwenit profile daily mean number of weekend night approvals 

pexpir profile expiry date stored in profile; update if curr date>pexpir 

phibal profile highest monthly balance 

phidcapv profile highest dollar ami on a single cash approve in a month 

phidedec profile highest dollar amt on a single cash decline in a month 

phidmapv profile highest dollar amt on a single merch approve in a month 

phidmdec profile highest dollar amt on a single merch decline in a month 

phidsapv profile highest dollar amount on a single approve in a month 

phidsau profile highest dollar amount on a single auth in a month 

phidsdec profile highest dollar amount on a single decline in a month 

phidtapv profile highest total dollar amount for an approve in a single day 

phidtau profile highest total dollar amount for any auth in a single day 

phidtdec profile highest total dollar amount for a decline in a single day 

phinapv profile highest number of approves in a single day 

phinau profile highest number of auths in a single day 

phindec profile highest number of declines in a single day 

pmlavbal profile average bah during 1st 10 days of mo. 

pmlnauths profile number of auths in the 1st 10 days of mo. 

pm2avbal profile average bah during 2nd 10 days of mo. 

prn2nauths profile number of auths in the 2nd 10 days of ma 

pm3&vb&l profile average bah during remaining days 

pm3namhs profile number of auths in the last pan of the month. 
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pmovewt 


profile uses last zip to determine recent residence move; pmovewt =2 for a move within 




the previous calendar month; pmovew 


pnaudy 


profile number of days with auihs 


pnauwl 


profile number of Sundays in month with any auths 


pnauw2 


profile number of Mondays in month with any auths 


pnauw3 


profile number of Tuesdays in month with any auths 


pnauw4 


profile number of Wednesdays in month with any anlhs 


pnauw5 


profile number of Thursdays in month with any auths 


pnauw6 


profile number of Fridays in month with any auihs 


pnauw7 


profile number of Saturdays in month with any auths 


pnauwd 


profile number of weekday days in month with any auths 


pnauwe 


profile number of weekend days in month with any auths 


pnesaudy 


profile number of days in month with cash auths 


pnmraudy 


profile number of days in month with merchant auths 


pnweekday 


profile number of weekday days in the month 


pnweelcend 


profile number of weekend days in the month 


pmtdcau 


profile ratio of declines to auths 


pro Cage 


profile number of months this account has had a profile (up to 6 mo.) 


psdaudy 


profile standard dev. of # days between transactions in a month 


psddau 


profile standard dev. of S per auth in a month 


ptdapv 


profile total dollars of approvals in a month 


ptdau 


profile total dollars of auths in a month 


ptdaudy 


profile total dollars of auths in a day 


ptdcs&pv 


profile total dollars of eaah advance approvals in & month 


ptdesdec 


profile total dollars of cash advance declines in a month 


ptddec 


profile total dollars of declines in a month 


ptdmrapv 


profile total dollars of merchandise approvals in a month 


ptdmrdec 


profile total dollars of merchandise declines in a month 


ptdsfaOl 


profile total dollars of transactions in SIC factor group 01 


ptdsfa02 


profile total dollars of transactions in SIC factor group 02 


ptdsfa03 


profile total dollars of transactions in SIC factor group 03 


ptdsfa04 


profile total dollars of transactions in SIC factor group 04 


ptdsfaOS 


profile total dollars of transactions in SIC factor group 05 


ptdsfa06 


profile total dollars of transactions in SIC factor group 06 


ptdsfa07 


profile total dollars of transactions in SIC factor group 07 


ptdsfa08 


profile total dollars of transactions in SIC factor group 08 


ptdsfa09 


profile total dollars of transactions in SIC factor group 09 


ptdsfalO 


profile total dollars of transactions in SIC factor group 10 


ptdsfall 


profile total dollars of transactions in SIC factor group 11 


ptdsraOl 


profile total dollars of transactions in SIC fraud rate group 01 


ptdsra02 


profile total dollars of transactions in SIC fraud rate group 02 


ptdsra03 


profile total dollars of transactions in SIC fraud rate group 03 


ptdsra04 


profile total dollars of transactions in SIC fraud rate group 04 


ptdsra05 


profile total dollars of transactions in SIC fraud rate group 05 


ptdsm06 


profile total dollars of transactions in SIC fraud rate group 06 


ptdsra07 


profile total dollars of transactions in SIC fraud rate group 07 


ptdsvaOl 


profile total dollars in SIC VISA group 01 


ptdsva02 


profile total dollars in SrC VISA group 02 


ptdsva03 


profile total dollars in SIC VISA group 03 


ptdsva04 


profile total dollars in SIC VISA group 04 


ptdsvaOS 


profile total dollars in SIC VISA group 05 


ptdsvaOS 


profile total dollars in SIC VISA group 06 


ptdsva07 


profile total dollars in SIC VISA group 07 


ptdsva08 


profile total dollars in SIC VISA group 08 


ptdsva09 


profile total dollars in SIC VISA group 09 


ptdsvalO 


profile total dollars in SIC VISA group 10 


ptdsvall 


profile total dollars in SIC VISA group 11 


ptnapv 


profile total number of approvals in a month 


ptnapvdy 


profile total number of approves a day 


ptnau 


profile total number of auths in a month 


ptoaulOd 


profile number of auths in month <- $10 


ptnaudy 


profile total number of auths in a day 


ptncsapv 


profile total number of cash advance approvals in a month 


pmcsdec 


profile total number of cash advance declines in a month 


ptndec 


profile total number of declines in a month 


ptndecdy 


profile total number of declines in a day 


ptnmxapv 


profile total nurnher of merchandise approvals in a month 


ptnmidec 


profile total number of merchandise declines in a month 


ptnsfaOl 


profile total number of transactions in SIC factor group 01 


ptnsfa02 


profile total number of transactions in SIC factor group 02 


ptnsfe03 


profile total number of transactions in SIC factor group 03 


ptasfe04 


profile total number of transactions in SIC factor group 04 


ptnsfeOS 


profile total number of transactions in SIC factor group 05 


ptnsfa06 


profile total number of transactions in SIC factor group 06 


ptnsEa07 


profile total number of transactions in SIC factor group 07 


ptnsfa08 


profile total number of transactions in SIC factor group 08 


ptasfa09 


profile total number of taansactions in SIC factor group 09 


ptnsfalO 


profile total number of transactions in SIC factor group 10 


ptnsfnll 


profile total number of transactions in SIC factor group 11 


ptnsraOl 


profile total number of transactions in SIC fraud rate group 01 
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ptnsra02 profile total number of transactions in SIC fraud rate group 02 

ptrare03 profile total number of transactions in SIC fraud rate group 03 

ptnsra04 profile total number of transactions in SIC fraud rate group 04 

ptnsraOS profile total number of taans actions in SIC fraud rate group 05 

ptnsr&06 profile total number of transactions in SIC fraud rale group 06 

ptnsra07 profile total number of transactions in SIC fraud rate group 07 

ptnsvaOl profile total number in SIC VISA group 01 

ptnsva02 profile total number in SIC VISA group 02 

ptnsva03 profile total number in SIC VISA group 03 

ptnsva04 profile total number in SIC VISA group 04 

ptnsva05 profile total number in SIC VISA group 05 

ptnsva06 profile total number in SIC VISA group 06 

ptnsva07 profile total number in SIC VISA group 07 

ptnsva08 profile total number in SIC VISA group OS 

ptasvaOP profile total number in SIC VISA group 09 

ptnsvalO profile total number in SIC VISA group 10 

ptnsvall profile total number in SIC VISA group 11 

ptnwlapv profile total number of approvals on Sundays (day 1 of week) 

ptnw2apv profile total number of approvals on Mondays (day 2 of week) 

ptnw3apv profile total number of approvals on Tuesdays (day 3 of week) 

ptnw4apv profile total number of approvals on Wednesdays (day 4 of week) 

ptnw5apv profile total number of approvals on Thursdays (day 5 of week) 

ptnw6apv profile total number of approvals on Fridays (day 6 of week) 

ptnw7apv profile total number of approvals on Saturdays (day 7 of week) 

ptowdaft profile total number of weekday afternoon approvals in a month 

ptnwdapv profile total number of weekday approvals in a month 

ptnwdeve profile total number of weekday evening approvals in a month 

ptnwdmor profile total number of weekday morning approvals in a month 

ptnwdnit profile total number of weekday night approvals in a month 

ptnweaft profile total number of weekend afternoon approvals in a month 

ptnwcapv profile total number of weekend approvals in a month 

ptnweeve profile total number of weekend evening approvals in a month 

pmwemor profile total number of weekend morning approvals in a month 

ptnwenit profile total number of weekend night approvals in a month 

pvdaybtwn profile variance in number of days between trx's (rnin of 3 trx) 

pvraudl profile variance of dollars per auth access month 

MERCHANT FRAUD VARIABLES 



mtotturn Merchant Total turnover for this specific merchant 

msicturn Merchant Cumulative SIC code turnover 

mctrtage Merchant Contract age for specific merchant 

maagsic Merchant Average contract age for this SIC code 

mavgnbtc Merchant Average number of transactions in a batch 

maamttrx Merchant Average amount per transaction (average amount per authorizations) 

mvaramt Merchant Variance of amount per transaction 

mavgtbtc Merchant Average time between batches 

mavgtaut Merchant Average time between authorizations for this merchant 

mratks Merchant Ratio of keyed versus swiped transactions 

mnidclac Merchant Number of identical customer accounts 

mnidcharn Merchant Number of identical charge amounts 

mtrxsrc Merchant What is the source of transaction (ATM, merchant, etc.) 

mtrxtrsp Merchant How is the transaction transported to the source (terminal, non-terminal, 

voice authorization) 

mfloor Merchant Floor limit 

mchgbks Merchant Charge-backs received 

mitrvs Merchant Retrievals received (per SIC, merchant, etc). The issuer pays for a retrieval, 

macqrat Merchant Acquirer risk managment rate (in Europe one merchant can have multiple 

acquires, but they dont have records about how many or who.) 

mprevrsk Merchant Previous risk management at this merchant? Yes or No 

mtyprsk Merchant Type of previous risk management (counterfeit, multiple imprint, 

Iost/stolen/not received) 

msicrat Merchant SIC risk management rate 

mpctaut Merchant Percent of transactions authorized 



Network Training: Once pre-processing is complete, the 
fraud-related variables are fed to the network and the net- 
work is trained. The preferred embodiment uses a modeling 
technique known as a "feed forward" neural network. This 
type of network estimates parameters which define relation- 6Q 
ships among variables using a training method The pre- 
ferred training method, well known to those skilled in the 
art, is called "backpropagation gradient descent 
optimization", although other well-known neural network 
training techniques may also be used. 65 

One problem with neural networks built with conven- 
tional backpropagation methods is insufficient gpneralizabil- 



ity. Generalizability is a measure of the predictive value of 
a neural network. The attempt to maximize generalizability 
can be interpreted as choosing a network model with enough 
complexity so as not to uaderfit the data but not too much 
complexity so as to overfit the data. One measure of the 
complexity of a network is the number of hidden processing 
elements, so that the effort to maximize generalizability 
translates into a selection among models having different 
numbers of hidden processing elements. Unfortunately, it is 
often not possible to obtain all the nonlinearity required for 
a problem by adding hidden processing elements without 
introducing excess complexity. Many weights that come 
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with the addition of each new hidden processing element cost function, small weights decay rapidly, while large 

may not be required or even helpful for the modeling task at weights decay slowly or not at all. 

hand. These excess weights tend to make the network fit the A major failing of the Weigend cost function, and similar 

idiosyncrasies or "noise" of the data and thus fail to gencr- weight decay schemes, is that they do not accurately mimic 

alize well to new cases. This problem, known as overfitting, 5 the intended prior distribution. Finding a good prior distri- 

typically arises because of an excess of weights. bution (or "prior") is a key element to developing an 

Weight decay is a method of developing a neural network effective model. Most of the priors in the literature are 

that minimizes overfitting without sacrificing the predictive sufficient to demonstrate the concept of weight decay but 

power of the model This method initially provides the 10 lack ^ strengths required to accommodate a wide ran^ of 

network with all the nonlinearity it needs by providing a problems. This occurs because the priors tend to decay 

large number of hidden processing elements. Subsequently, weights evenly for a given processing element, without 

it decays all the weights to varying degrees so that only the sufficiently distinguishing important weights (which contain 

weights that are necessary for the approximation task more information) from unimportant weights (which contain 

remain. Two central premises are employed: 1) when given 15 Ie ss information). This often results either in 1) undesired 

two models of equivalent performance on a training data set, decaying of important weights, which diminishes the power 

favor the smaller model; and 2) implement a cost function of the system to accommodate nonlinearity, or 2) undesired 

that penalizes complexity as part of the backpropagation retention of excess unimportant weights, which leads to 

algorithm. The network is trained by minimizing this cost 2 o over fi ltm g- 

function. Complexity is only justified as it expresses infor- The present invention uses the following improved cost 

mation contained in the data. A weight set that embodies all function, which addresses the above problems: 
or almost all of the information in the data and none of the 

noise will maximize generalizability and performance. 2 (target* - output*) 2 Z (goi, 2 - 1 + — ) (Eq * ^ 

The cost function is constructed by introducing a "decay 25 460 kW\ + K1 / 

term" to the usual error function used to train the network. where g represents a new term known as the interlayer gain 

It is designed to optimize the model so that the network multiplier for the decay rate, and c ± is a constant The 

captures all the important information in the training set, but interlayer gain multiplier takes into account the relative 

does not adapt to noise or random characteristics of the proximity of the weights to the input and output ends of the 

training set In view of these requirements, the cost function network. Thus, the interlayer gain multiplier allows appli- 

must take into account not only prediction error, but also the c u ation of * e ^ < erm ^ ^ ater P 0 * 00 * to elemen u ts 

. c . , . , A * . . . - . that are closer to the inputs, where the majority of the 

significance of model weights. A combination of these two ^ ^ ay oq 

terms yields an objective function which, when minimized, weigfats ^^^^ to elements closer to me outputs , 

generalizes optimally. Performing a conventional gradient 35 which afe mQre critical) since their elimination can effec- 

descent with this objective function optimizes the model. UV ely sever large numbers of input-side weights. 

In introducing the decay term, an assumption is made By intensifying decay on input-side elements, the cost 

about what constitutes information. The goal is to choose a function of Equation 2 improves the ability of model devel- 

decay term that accurately hypothesizes the prior distribu- ^ opment component 801 to decay individual weights while 

tion of the weights. In finding a good prior distribution, one preserving processing elements containing valuable infor- 

examines the likelihood that the weights will have a given mation. The result is that weak interactions are eliminated 

distribution without knowledge of the data. while valid interactions are retained. By retaining as many 

Weigend et al, "Generalization by Weight-Elimination processing elements as possible, the model does not lose the 

with Application to Forecasting", in Advances in Neural 45 power to model nonlinearities, yet the overfitting problem is 

Information Processing Systems 3, pp. 875-82, and incor- reduced because unnecessary individual weights are 

porated herein by reference, discloses the following cost removed. 

function for weight decay: Once the cost function has been iteratively applied to the 

network, weights that have been decayed to a very small 
— I (target*- output*) 2 +x X oy,2 ^° 2 O 5 * J ) number (defined as e) are removed from the network. This 
2 * w 1 + a> i' 2 / < *> 2 step, known as "thresholding the net" is performed because 
where: it is often difficult to completely decay weights to zero. 
D is the data set; Once the network has been trained using past data, the 
target* is the target, or desired, value for element k of the 55 network's model definition is stored in data files. One 
data set; portion of this definition, called the "CFG" file, specifies the 
output* is the network output for element k of the data set; parameters for the network's input variables, including such 
X represents the relative importance of the complexity information as, for example, the lengths of the variables, 
term; mc ir types* and their ranges. Referring now to FIG. 21, there 
W is the weight set; 6 ° is shown a portion of a typical CFG file, specifying param- 
os is the value of weight i; and eters *° r an ACCOUNT variable 2101 (representing a cus- 
is a constant that controls the shape of the curve that tomer account number) and a PAUD YMD Y variable 2102 (a 
penalizes the weights. profile variable representing the ratio of transaction days 
The first term of the Weigend function measures the 65 divided by the number of days in the month), 
performance of the network, while the second term measures The file formats used to store the other model definition 
the complexity of the network in terms of its size. With this files for the network are shown below. 
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ASCII File Formats 



The ASCII network data files (.da, .sta, Jca, .wta) consist of to teas 
(no n- whites pace) separated by whites pace (space, tab, newline). 
Whitcspacc is ignored except to separate tokens. Use of line breaks 
and tabs is encouraged for clarity, but otherwise irrelevant. 
File format notation is as follows: 

* Bracketed text denotes a token. 

* No ob racketed text denotes a literal token which must be 
matched exactly, including case. 

" Comments on the right are not part of the file format; they 
simply provide further description of the format. 
" In the comments, vertical lines denote a block which can be 
repeated. Nested vertical Lines denote repea table sub-blocks. 

.eta Format 

File format Comments 



cts 

<NetName> 

<VWue> | Repeated as needed 

cts and <NetName> must appear first <NetName> is the standard 
abbreviation, lowercase (e.g., mbpn). The <VaIue>s are the 
network constants values, in the order defined within the 
constants structure. If a constants value is an array or structured 
type, each element or field must be a separate token, appearing in 
the proper order. 

Example Comments 



cts 
mbpn 



2 


[nputSize 


1 


Outputs izc 


1 


cHidSlabs 


2 


HiddenSizefO] 


0 


Hidden5ize[l] 


0 


HiddenSize[2] 


3 


RandomSeed 


1.0 


[nitWeightMax 


0 


WtsUpdateFlag 


0 


Connect Inputs 


0 


FnClass 


1.0 


Parml 


1.0 


Parm2 


-1.0 


Parm3 


0.0 


Pann4 


0.0 


ParmS 


1 


cEntTbl 


0.0 


xLow 


0.1 


xHigh 


0.2 


HiddenAlphafO] 


0.0 


HiddcnAlphafl] 


0.0 


HiddenAlpha[2] 


0.1 


OutputAlpha 


0.9 


HiddenBetalO] 


0.0 


Hiddenfieta[l] 


0.0 


Hiddenfieta[2] 


0.9 


OutputBeta 


0.0 


Tolerance 


0 


WtsUpdateFlag 


0 


BatchSize 


0 


LinearOutput 


0 


ActTblFlag 


1 


StatsFlag 


1 


LearnFlag 



In this example, HiddcnSize, HiddenAlpha, and HiddcnBeta are all 
arrays, so each element (0, 1, 2) has a separate token, in the order 
they appear in the type. 

.sta Format 

File format Comments 



sts 

<NetName> 
<cSlab> 

<nSlab> | Repeated cSlab limes 
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ASCII File Formats 



<cPc> | 

<state> | { Repeated cPe times 

sts and <NetName> must appear first. <NcuN'ane> is the standard 
abbreviation, lowercase. <cSteb> is a count of the slabs which 
have states stored in the file. The remainder of the file consists of 
cSlab blocks, each describing the states of one slab. The order of 
the slab blocks in the file is not important. <nSlab> is the slab 
camber, as defined in the xxx.h ale. cPe is the cumber of states for 
the slab. <state> is the value of a single state. If the state type is 
an array or structured type, each element or field must be a 
separate token, appearing in the proper order. There should be cPe 
<state> values in the slab block. 



Example 


Comments 


sts 




mbpn 




6 


cSlab 


0 


□Slab — SlablnMbp a 


2 


cPeln 


0.0 


Stsln[0] 


0.0 


Stalnilj 


1 


nSlab — SlabTmMbp n 


1 


cPeTrn 


0.0 


StsTrn[0] 


2 


nSlab — SlabHidOMbpn 


2 


cPeHidO 


0.0 


Stsffid0[0] 


0.0 


Stsffid0[l] 


5 


nSlab — SlabOutMbpn 


1 


cPeOut 


0.0 


StsOut(0] 


6 


□Slab — SlabBiasMbpn 


1 


cPeBias 


1.0 


StsBiasfO] 


7 


nSlab — SlabStatMbpn 


3 


cPeStat 


0.0 


StsStat[0] 


0.0 


StsStatjl] 


0.0 


StsStat[2] 



.lea Format 

File format Comments 



lcl 

<NetName> 

ccSlab> 

<nSlab> } Repeated cSlab times 
<cPe> j 

<local> 1 1 Repeated cPe times 



The Jca format is just like the .sta format except that sts is 
replaced by lcl. lcl and <NctName> must appear first. 
<NetName> is the standard abbreviation, lowercase. <:cSlab> is a 
count of the slabs which have local data stored in the file. The 
remainder of the file consists of cSlab blocks, each describing the 
local data values of one slab. <nSlab> is the slab number, as 
defined in the xxx.h file. The order of the slab blocks in the file is 
not important cPe is the number of local data values for the slab. 
<local> is the value of a single local data element. If the local 
data type is an array or structured type, each element or field must 
be a separate token, appearing in the proper order. There should 
be cPe <docal> values in the slab block. 



Example Comments 



Id 

mbpn 

3 cSlab 

2 nSlab— SlabHidOMbpn 

2 cPe 

0.0 LdHidOjO]. Error 

0.0 LdHidO[oiNetInp 

0.0 LdHidoiliEnor 

0.0 LciHid0[liNetInp 
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ASCII File Formats 



5 


nSlab — SlabOuiMbpn 


1 


cPe 


0.0 


LdOutfO]. Error 


0.0 


LdOirj0].Nednp 


7 


□Slab — SlabStatMbpn 


3 


cPc 


0 


LdStaltO].clLcr 


0-0 


LdStat(0].Sum 


0 


LdStat[l].dter 


0.0 


LclScat(l].Sum 


0 


LclStat{2].citer 


0.0 


LclStnt(2].Sum 



In this example, the <locat> values are all structured types, so 
each field (Error and Netlnp; clter and Sum) has a separate token, 
in the odcr they appear in the type. 

.wta Format 

File format Comments 



wts 

<NetNamc> 
<cQass> 

<nSlab> | Repeated cdass times 
<nOass> j 
<clcn> j 

<weighl> j | Repeated clcn times 

wts and cNctNamo must appear first. <NctNamc> is the standard 
abbreviation, lowercase. <cClass> is a count of the slab/class 
combinations which have weight stored in the file. The remainder 
of the file consists of cdass blocks, each describing the weights of 
one slab. The order of the class blocks in the file is not important 
<nSlab> is the slab number, as defined in the xxx.h file. <nOass> 
is the class number, as defined in the xxx.h file. <weight> is the 
value of a single weight, [f the weight type is an array or 
structured type, each element or field must be a separate token, 
appearing in the proper order. There should be clcn <weight> 
values in the slab block. 
Example Comments 



wts 




mbpn 




2 


cdass 


2 


nSlab— SlabHidOMbpn 


0 


nClass — PeffidOMbp nFromPre v 


6 


clcn 


0.0 


Wtsffid0[PE_0l0] 


0.0 


WtsHid0[PE_0ll] 


0.0 


WtsHid0[PE_0l2] 


0.0 


WtsHidO[PE_llO] 


0.0 


WtsHidO[PE_lIl] 


0.0 


WtsHidO[PE_ll2] 


5 


□Slab — SlabOuiMbpn 


0 


nClass — PeOutMbnpnFromPrev 


3 


clcn 


0.0 


WtsOut[PE_J)p] 


0.0 


WtsOut[PE_0Hl] 


0.0 


WtsOut[PE_0]I2] 



Weights values for a slab and class are stored as a one-dimensional 
array, but conceptually are indexed by two values — PE and 
interconnect within PE. The values are stored in row- major order, 
as exemplified here. 



26 



Transaction Processing Component 802 

Once the model has been created, trained, and stored, 
fraud detection may begin. Transaction processing compo- 
nent 802 of system 100 preferably runs within the context of 
a conventional authorization or posting system for customer 
transactions. Transaction processing component 802 reads 
current transaction data and customer data from databases 
805, 806, and generates as output fraud scores representing 



60 the likelihood of fraud for each transaction. Furthermore, 
transaction processing component 802 can compare the 
likelihood of fraud with a predetermined threshold value, 
and flag transactions for which the threshold is exceeded. 
The current transaction data from database 805 typically 

65 includes information such as: transaction dollar amount; 
date; time (and time zone if necessary); approve/decline 
code; cash/merchandise code; available credit (or balance); 
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credit line; merchant category code; merchant ZIP code; and 1603, as well as profile data summarizing transactional 
PIN verification (if applicable). patterns for the customer 1604. It then applies this data to the 

The customer data from database 806 typically includes stored neural network model 1605. A fraud score 
information from three sources: 1) general information on (representing the likelihood of fraud for the transaction) is 

the customer; 2) data on all approved or declined transac- 5 obtained 1606 and compared to a threshold value 1607. 
tions in the previous seven days; and 3) a profile record Steps 1601 through 1607 occur before a transaction is 
which contains data describing the customer's transactional authorized, so that the fraud score can be sent to an autho- 
pattem over the last six months. The general information on rization system 1608 and the transaction blocked by the 
the customer typically includes information such as: cus- authorization system if the threshold has been exceeded. If 

tomer ZIP code; account open date; and expiration date. The 10 the threshold is not exceeded, the low fraud score is sent to 
profile record is a single record in a profile database sum- the authorization system 1609. The system then updates 
marizing the customer's transactional pattern in terms of customer profile database 806 with the new transaction data 
moving averages. The profile record is updated periodically 1610. Thus, in this system, profile database 806 is always up 
(usually monthly) with all of the transactions from the to date (unlike the batch and semi-real-time systems, in 

period for the customer, as described below. is which profile database 806 is updated only periodically). 

System 100 can operate as either a batch, semi-real-time, Referring now to FIG. 12, there is shown the method of 
or real-time system. The structure and processing flow of creating a profile record. The system performs the steps of 
each of these variations will now be described. this method when there is no existing profile record for the 

Batch System: FIG. 14 shows operation of a batch system. customer. The system reads the past transaction database 

Transactions are recorded throughout the day or other con- 20 1101 for the past six months and the customer database 1103 
venient period 1402. At the end of the day, the system (steps 1202 and 1203 respectively). It generates a new 
performs steps 1403 to 1409 for each transaction, It obtains profile record 1204 with the obtained data and saves it in the 
data describing the current transaction 1403, as well as past profile database 1205. If there are more accounts to be 
transaction data, customer data, and profile data 1404. It men processed 1206, it repeats steps 1202 through 1205. 

applies this data to the neural network 1405 and obtains a 25 Referring now to FIG. 13, there is shown the method of 
fraud score 1406. If the fraud score exceeds a threshold updating an existing profile record. The system reads the 
1407, the account is flagged 1408. In the batch system, past transaction database 1101 for the past six months, 
therefore, the transaction which yielded the high fraud score customer database 1103 and profile database (steps 1302, 
cannot itself be blocked; rather, the account is flagged 1404 1303, and 1304 respectively). It combines the data into a 

at the end of the day so that no future transactions are 30 single value for each variable in the profile database. This 
possible. Although the batch system does not permit imme- value is generated using one of two formulas, 
diate detection of fraudulent transactions, response-time For variables that represent average values over a period 
constraints may mandate use of the batch system in some of time (for example, mean dollars of transactions in a 
implementations. month), Equation 3 is used: 

Semi-Real-Time System: The semi-real-time system 35 ^ _ K ijm m % , _ _ 

4 . ... J . . . . . j .u ncwProfl^ta^(l-a)*oldProfI>ata)+(a*cuircDtMil)) (Eq.3) 

operates m a similar manner to the batch system and uses the v 

same data files, but it ensures that no more than one For variables that represent extreme values over a period 

high-scoring transaction is authorized before flagging the of time (for example, highest monthly balance), Equation 4 

account. In this system, as shown in FIG. 15, fraud like Li- is used: 

hood determination is performed (steps 1504 to 1509) 40 

immediately after the transaction is authorized 1503. Steps 

1504 to 1509 correspond to Steps 1403 to 1409 of the batch newProfl>ata-max(cunent^l,p*oldProEData) (Eq.4) 

system illustrated in FIG. 14. If the likelihood of fraud is \ D Equations 3 and 4: 

high, the account is flagged 1509 so that no future transac- newProfData is the new value for the profile variable; 

tions are possible. Thus, as in the batch system, the current 45 . ,„ ~~ . . . . . c t . ... 

. v , n i j i_ J_ . | . oldProfData is the old value for the profile variable; 

transaction cannot be blocked; however, the semi-real- time , , , . , . * , . , , r 

system allows subsequent transactions to be blocked. currentVal is the most recent value of the variable, from 

Real-Time System: The real-time system performs fraud mc ^ transaction database; and 

likelihood determination before a transaction is authorized. a and p are decay factors which are used to give more 

Because of response-time constraints, it is preferable to 50 importance to recent months and less importance to 
minimize the number of database access calls when using months further in the past. 

the real-time system. Thus, in this embodiment, all of the The value of P is set so that older data will "decay" at an 
customer information, including general information and acceptable rate. A typical value for 0 is 0.95. 
past transaction data, is found in a single record of profile The value of a is generated as follows: For the batch and 

database 806. Profile database 806 is generated from past 55 semi-realtime systems, a is set to a value such that the 
transaction and customer data before the transaction pro- contribution of the value from more than six months previ- 
cessing component starts operating, and is updated after ous is nearly zero. For profiles that have been in existence 
each transaction, as described below. Because all needed for at least six months, the value of a is Ye. For newer 
data are located in one place, the system is able to retrieve profiles, the value is l/(n+l), where n is the number of 

the data more quickly than in the batch or semi-real-time 60 months since the profile was created For the real-time 
schemes. In order to keep the profile database 806 current, system, profile updates do not occur at regular intervals, 
profile records are updated, using moving averages where Therefore, a is determined using the following equation: 
applicable, after each transaction. 

Referring now to FIG. 16, there is shown a flowchart of a=i-«p(-tf7) (Eq.5) 

a real-time system using the profile database. Upon receiv- 65 where: 

ing a merchant's request for authorization on a transaction t is the time between the current transaction and the last 
1602, the system obtains data for the current transaction transaction; and 
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T is a time constant for the specific variable. 

Furthermore, for the real-time system, current\frl repre- 
sents the value of the variable estimated solely using infor- 
mation related to the current transaction and the time since 
the last transaction, without reference to any other historical 
information. 

Once the new values for the profile variables have been 
generated, they are placed in an updated profile record 1305 
and saved in the profile database 1306. If there are more 
accounts to be processed 1307, the system repeats steps 
1302 through 1306. 

In all of these embodiments, the current transaction data 
and the customer data are preferably pre-processed to derive 
fraud-related variables which have been empirically deter- 
mined to be effective predictors of fraud. This is done using 
the same technique and the same fraud-related variables as 
described above in connection with neural network training. 

Referring now to FIGS. 17 through 19, there are shown 
flowcharts illustrating the operation of the preferred embodi- 
ment of the transaction processing component. Some of the 
individual elements of the flowchart are indicated by des- 
ignations which correspond to module names. The following 
brief description summarizes the processing. 

Referring now to FIG. 17, there is shown the overall 
operation of transaction processing component 802. First the 
system runs module Q NIT- NET 1702, which initializes 
network structures. Then, it runs module CSCORE 1703. 
Module CSCORE 1703 uses current transaction data, data 
describing transactions over the past seven days, a profile 
record, and customer data to generate a fraud score indicat- 
ing the likelihood that the current transaction is fraudulent, 
as well as reason codes (described below). The system then 
checks to see whether there are more transactions to be 
processed 1704, and repeats module CSCORE 1703 for any 
additional transactions. When there are no more to be 
processed, the system runs module FREENET 1705, which 
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frees the network structures to allow them to be used for 
further processing. 

Referring now to FIG. 18, there is shown the operation of 
module CSCORE 1703. First, module CSCORE 1703 

5 obtains current transaction data, data describing transactions 
of the past seven days, the profile record, and customer data 
(steps 1802 through 1805). From these data, module 
CSCORE 1703 generates the fraud-related variables 1806 
described above. Then, it runs module DeployNet 1807, 

10 which applies the fraud-related variables to the stored neural 
network and provides a fraud score and reason codes. 
CSCORE then outputs the score and reason codes 1808. 
Referring now to FIG. 19, there is shown the operation of 

1S module DeployNet 1807. Module DeployNet 1807 first 
scales the fraud-related variables 1902 to match the scaling 
previously performed in model development. If the value of 
a variable is missing, DeployNet sets the value to equal the 
mean value found in the training set. Then it applies the 

M scaled variables to the input layer of neural network 108, in 
step 1903. In step 1904, it processes the applied data through 
the network to generate the fraud score. The method of 
iterating the network is well known in the art 

In addition to providing fraud scores, in step 1904, 

25 module DeployNet 1807 optionally generates "reason 
codes". These codes indicate which inputs to the model are 
most important in determining the fraud score for a given 
transaction. Any technique that can track such reasons may 
be used. In the preferred embodiment, the technique set forth 

30 in co -pending U.S. application Ser. No. 07/814,179, 
(attorney's docket number 726) for "Neural Network Hav- 
ing Expert System Functionality", by Curt A. Levey, filed 
Dec. 30, 1991, the disclosure of which is hereby incorpo- 
rated by reference, is used. 

35 The following module descriptions summarize the func- 
tions performed by the individual modules. 
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FILE NAME: CINTTNET 

DESCRIPTION: Contains code to allocate and initialize the network 
structures. 

FUNCTION NAME: CINITNET( ) 

DESCRIPTION: Allocate and initialize the network structures. 
FILE NAME: CSCORE 

DESCRIPTION: Generates fraud related variables and iterates the neural 
network. 

FUNCTION NAME: SCORE( ) 

DESCRIPTION: Creates fraud related variables from raw variables 

and make calls to initialize the input layer and iterate the neural network. 

FUNCTION NAME: setlnput( ) 

DESCRIPTION: Sets the input value for a processing clement in the input layer. 
FUNCTION NAME: hiReason( ) 

DESCRIPTION: Finds the three highest reasons for the score. 
FILE NAME: CFREENET 

DESCRIPTION: Makes function calls to free the network structures. 

FUNCTION NAME: CFREENET( ) 

DESCRIPTION: Frees the network structures. 
FILE NAME: CCREATEP 

DESCRIPTION: Contains the cardholder profile creation code. 
FUNCTION NAME: crcatcpf( ) 

DESCRIPTION: Creates a profile record for a cardholder using the previous 
month's authorizations and cardholder data. 
FILE NAME: CUPDATEP 

DESCRIPTION: Updates a profile of individual cardholder activity. 
FUNCTION NAME: updatepf( ): 

DESCRIPTION: Updates a profile record for a cardholder using the previous 
profile record values as well as the previous month's 
authorizations and cardholder fo ta 
FILE NAME: CCOMMON 

DESCRIPTION: This file contains functions which are needed by at least two of the 
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following; creatpf( ), updatepf( ), score( ). 

FUNCTION NAME: accumMiscCnts( ) 

DESCRIPTION: Increments counters of various types for each 

authorization found. 

FUNCTION NAME: accumSicCnU( ) 

DESCRIPTION: Increments SIC variable counters, 

FUNCTION NAME: initSicCounts( ) 

DESCRIPTION: Initializes the SIC variable counters. 

FUNCTION NAME: updateSicMovAvgs( ) 

DESCRIPTION: Updates the SIC profile variables. 

FUNCTION NAME: writeMiscIbProfile< ) 

DESCRIPTION: Writes various variables to the profile record 

after they have been calculated. 

FUNCTION NAME: hncDate( ) 

DESCRIPTION: Converts a Julian date to a date indicating 
the number of days since Jan 1, 1990. 
FUNCTION NAME: missSir( ) 

DESCRIPTION: Checks for "missing'* fiag (a period) in a null 
terminated string. String must have only blanks 
and a period to qualify as missing. A string with 
only blanks will also qualify as "missing". 



Cascaded Operation 

One way to improve system performance is via "cas- 25 
caded" operation. In cascaded operation, more than one 
neural network model is used. The second neural network 
model is trained by model development component 801 in a 
similar manner to that described earlier. However, in training 
the second model, model development component 801 uses 
only those transactions that have fraud scores, as determined 30 
by prior application to the first neural network model, above 
a predetermined cascade threshold. Thus, the second model 
provides more accurate scores for high -scoring transactions. 
While the same fraud-related variables are available to train 
both models, it is often the case that different variables are 35 
found to be significant in the two models. 

Referring now to FIG. 20, there is shown a flowchart of 
the operation of the transaction processing component in a 
cascaded system. First, transaction processing component 
802 scores each transaction using the first model 2002, as 40 
described above. Those transactions that score above the 
cascade threshold 2003 are applied to the second neural 
network model 2005. The system outputs scores and reason 
codes from either the first model 2004 or the second model 
2006, as appropriate. 45 

The above -described cascading technique may be 
extended to include three or more neural network models, 
each having a corresponding cascade threshold. 
Performance Monitor 

The system periodically monitors its performance by 50 
measuring a performance metric comprising the fraud detec- 
tion rate and the false positive rate. Other factors and 
statistics may also be incorporated into the performance 
metric. When the performance metric falls below a prede- 
termined performance level, the system may either inform 55 
the user that the fraud model needs to be redeveloped, or it 
may proceed with model redevelopment automatically. 

From the above description, it will be apparent that the 
invention disclosed herein provides a novel and advanta- 
geous method of detecting fraudulent use of customer 60 
accounts and account numbers, which achieves high detec- 
tion rates while keeping false positive rates relatively low. 
The foregoing discussion discloses and describes merely 
exemplary methods and embodiments of the present inven- 
tion. As will be understood by those familiar with the art, the 65 
invention may be embodied in many other specific forms 
without departing from the spirit or essential characteristics 



thereof. For example, other predictive modeling techniques 
besides neural networks might be used. In addition, other 
variables might be used in both the model development and 
transaction processing components. 

Accordingly, the disclosure of the present invention is 
intended to be illustrative of the preferred embodiments and 
is not meant to limit the scope of the invention. The scope 
of the invention is to be limited only by the following claims. 

What is claimed is: 

1. In a computer having a processor and storage, a 
computer-implemented process for detecting a fraudulent 
transaction in a customer account, comprising the steps of: 

obtaining past transaction data for processing by the 
computer 

pre-processing the past transaction data to derive past 

fraud related variables; 
generating a predictive model with the processor from the 

past fraud related variables; 
storing a representation of the predictive model in the 

computer storage; 
receiving current transaction data for processing by the 

processor; 

receiving customer data for processing by the processor; 
and 

generating a computer signal indicative of the likelihood 
of fraud in the current transaction, wherein the proces- 
sor generates the computer signal by applying the 
current transaction data and the customer data to the 
stored predictive model. 

2. The computer-implemented process of claim 1, 
wherein the step of obtaining customer data comprises 
accessing a computer database containing general customer 
data and a computer database containing customer transac- 
tional pattern data. 

3. The computer-implemented process of claim 1, 
wherein the step of obtaining customer data comprises 
accessing no more than one profile computer database 
record containing customer transactional pattern data. 

4. The computer-implemented process of claim 3, 
wherein the profile computer database record further con- 
tains general customer data. 

5. The computer-implemented process of claim 1, 
wherein the current transaction data and the customer data 
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each comprise a plurality of elements and the computer 
processes each element by: 
determining a relative contribution of the element to the 

determined likelihood of fraud; 
determining from each relative contribution thus deter- 
mined a reason code value; and 
generating a computer signal indicative of the reason code 
value. 

6. The computer-implemented process of claim 1, further 
comprising the steps of: 

comparing the computer signal indicative of the likeli- 
hood of fraud with a preset threshold value; and 

responsive to the computer signal exceeding the preset 
threshold value, generating a computer signal indicat- 
ing fraud. 

7. The computer-implemented process of claim 1, further 
comprising the iterative steps of: 

determining a cascade threshold value; 

comparing the computer signal indicative of the likeli- 
hood of fraud with the cascade threshold value; and 

responsive to the computer signal exceeding the cascade 
threshold value, generating another computer signal 
indicative of the likelihood of fraud in the current 
transaction by applying the current transaction data and 
the customer data to another predictive model. 

8. The computer-implemented process of claim 1, further 
comprising the steps of: 

monitoring a performance metric of the computer gener- 
ated predictive model, wherein the processor monitors 
the performance metric; 

comparing the performance metric with a predetermined 
performance level; and 

generating and storing a new predictive model from past 
transaction data responsive to the performance level 
exceeding the performance metric, wherein the new 
predictive model is generated by the processor and 
stored in the computer storage. 

9. the computer-implemented process of claim 8, wherein 
the performance metric comprises: 

a fraud detection rate measurement; and 
a false positive rate measurement. 

10. The computer-implemented process of claim 1, fur- 
ther comprising the steps of: 

pre-processing the current transaction data to derive cur- 
rent fraud-related variables; and 

pre-processing the customer data to derive customer 
fraud-related variables; 

wherein the computer signal representing the likelihood 
of fraud is generated responsive to application of the 
current fraud-related variables and the customer fraud- 
related variables to the stored predictive model. 

11. The computer-implemented process of claim 10, 
wherein the past fraud-related variables and the current 
fraud-related variables each comprise at least: 

factors obtained from data referring to transaction dollar 
amounts related to fraud; 

factors obtained from data referring to transaction dates 
and times related to fraud; 

factors obtained from data referring to transaction approv- 
als and declines related to fraud; and 

factors obtained from data referring to risk groups related 
to fraud. 

12. The computer-implemented process of claim 10, 
wherein the past fraud-related variables and the current 
fraud-related variables each comprise at least: 
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factors obtained from data referring to customers related 
to fraud; and 

factors obtained from data referring to merchants related 
to fraud. 

13. The computer-implemented process of claim 10, fur- 
ther comprising the steps of, for each variable in the set of 
derived current fraud-related variables and derived customer 
fraud-related variables: 

determining a relative contribution of the variable to the 
determined likelihood of fraud; 

determining from each relative contribution thus deter- 
mined a reason code value; and 

generating a computer signal indicative of the reason code 
value. 

14. A computer-implemented process for detecting fraud 
for a transaction on a customer account, comprising the steps 
of: 

obtaining past transaction data for processing by the 
computer; 

pre-processing the past transaction data to derive past 

fraud-related variables; 
training a neural network on the computer with the 

derived past fraud-related variables; 
storing the neural network in storage associated with the 

computer; 

obtaining current transaction data for processing by the 
computer; 

pre-processing the current transaction data to derive cur- 
rent fraud-related variables; 

obtaining customer data for processing by the computer; 

pre-processing the customer data to derive customer 
fraud-related variables; and 

generating a computer signal representing the likelihood 
of fraud responsive to application of the current fraud- 
related variables and the customer fraud-related vari- 
ables to the stored neural network. 

15. In a computer having a processor and storage, a 
computer-implemented process of training a neural network, 
the neural network for predicting fraudulent transactions in 
a customer account based on selected data, the neural 
network being represented on the computer and stored in the 
computer storage and comprising a plurality of intercon- 
nected processing elements, each processing clement com- 
prising: 

a plurality of inputs; 

a plurality of weights, wherein each weight is associated 
with a corresponding input by the processor to generate 
weighted inputs; 
means for combining the weighted inputs; and 
a transfer function for processing the combined weighted 

inputs on the processor to produce an output; 
the training process comprising the iterative steps of: 
applying input data to the neural network to generate 
output data, wherein the processor applies the input 
data to the neural network and generates the output 
data; 

comparing the generated output data to a desired 
output, wherein the processor performs the compari- 
son; 

adjusting operation of the neural network responsive to 
the results of the comparing step; and 

after the iterative steps of applying, comparing, and 
adjusting, storing the neural network in the computer 
storage. 
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16. The computer-implemented process of claim 15, 
wherein the step of adjusting operation of the neural network 
comprises the substeps of: 

selecting a subset of the weights to be decayed; and 
decaying the selected subset of weights. 

17. The computer-implemented process of claim 16, 
wherein the substep of selecting a subset of the weights to 
be decayed comprises applying and minimizing a cost 
function including an interlayer gain multiplier which varies 
a decay rate responsive to the location of a weight within the 
network- 
lS. The computer-implemented process of claim 17, 

wherein the cost function is of the form: 

T j£> (target * • + ( ^ " i + M ) • 

wherein: 

D represents a data set; 

target^ represents a target value for element k of the data 
set; 

output* represents a network output for element k of the 
data set; 

g represents the interlayer gain multiplier; 
X represents the relative importance of the complexity 
term; 

W represents a weight set; 

a); represents a value of weight i; and 

c 2 represents a constant. 

19. A system for detecting a fraudulent transaction in a 
customer account, comprising: 

a computer processor for executing programmed instruc- 
tions and for storing and retrieving data; 

program memory, coupled to the processor, for storing 
program instruction steps for execution by the proces- 
sor; 

a predictive model component, coupled to the processor, 
for determining the likelihood of a fraudulent transac- 
tion; 

past transaction data storage, coupled to the processor, for 
receiving, storing, and sending past transaction data; 

a model development component, coupled to the 
processor, for training the predictive model based on 
the past transaction data in accordance with program 
instructions in the program memory and executed by 
the processor, thereby generating a trained predictive 
model; 

current transaction data storage, coupled to the processor, 
for receiving, storing, and sending current transaction 
data; 

customer data storage, coupled to the processor, for 
receiving, storing, and sending customer data; and 

an output device, coupled to the processor, for outputting 
a computer signal indicative of the likelihood of fraud 
in a transaction, wherein the processor generates the 
computer signal in accordance with program instruc- 
tions in the program memory and executed by the 
processor, said computer signal being responsive to the 
application of the current transaction data and the 
customer data to the trained predictive model. 

20. The system of claim 19, wherein the model develop- 
ment component derives past fraud-related variables as a 
function of the past transaction data, and said past fraud- 
related variables are used to train the predictive model. 
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21. The system of claim 19, wherein: 

the predictive model component comprises a neural 
network, coupled to the processor, and 

the model development component trains the neural net- 
work based on the past transaction data in accordance 
with program instructions in the program memory and 
executed by the processor, thereby generating a trained 
neural network; 
( wherein the processor generates the computer signal by 
applying the current transaction data and the customer 
data to the trained neural network. 

22. The system of claim 19, further comprising: 

a past transaction data pre -processor, coupled to the 
; processor, for deriving past fraud-related variables 
from the past transaction data; 
wherein the model development component trains the 
predictive model based on the past fraud-related vari- 
ables in accordance with program instructions in the 
20 program memory and executed by the processor, 
thereby generating the trained predictive model; 
a current transaction data pre-processor, coupled to the 
processor, for deriving current fraud-related variables 
from the current transaction data; and 
25 a customer data pre-processor, coupled to the processor, 
for deriving customer fraud-related variables from the 
customer data; 
wherein the processor generates the computer signal by 
30 applying the current fraud-related variables and the 
customer fraud-related variables to the trained predic- 
tive model. 

23. In a system for detecting fraud in a transaction on an 
account belonging to a customer, the system including a 

35 computer processor for executing programmed instructions 
and for storing and retrieving data, a computer readable 
memory storing thereon: 

a neural network, coupled to the processor, for determin- 
ing the Likelihood of a fraudulent transaction; 
40 past transaction data storage, coupled to the processor, for 
receiving, storing, and sending past transaction data; 
a past transaction data pre-processor, coupled to the 
processor, for deriving past fraud-related variables 
from the past transaction data; 
45 a model development component, coupled to the 
processor, for training the neural network based on the 
past fraud-related variables, thereby generating a 
trained neural network; 
current transaction data storage, coupled to the processor, 
for receiving, storing, and sending current transaction 
data; 

a current transaction data pre-processor, coupled to the 
processor, for deriving current fraud-related variables 
55 from the current transaction data; 

customer data storage, coupled to the processor, for 

receiving, storing, and sending customer data; and 
a customer data pre-processor, coupled to the processor, 
for deriving customer fraud-related variables from the 
60 customer data; 

wherein the processor generates a computer signal indica- 
tive of the likelihood of fraud in a transaction, said 
computer signal being responsive to the application of 
the current fraud-related variables and the customer 
65 fraud-related variables to the trained neural network. 

24. In a computer-controlled transaction processing sys- 
tem including predictive modeling means for receiving 



05/18/2004, EAST Version: 1.4.1 



5,819,226 



37 



38 



current transaction data, processing the current transaction 
data, and outputting a plurality of output values, including a 
score value representing a likelihood of a fraudulent 
transaction, an improved computer-implemented process for 
identifying and deterrnining fraudulent transaction data, 
comprising the steps of: 

prior to receiving the current transaction data for at least 

one current transaction; 
generating a consumer profile for each of a plurality of 
consumers from a plurality of past fraud-related vari- 
ables and from consumer data, each consumer profile 
describing historical spending patterns of a correspond- 
ing consumer, the past fraud-related variables being 
derived by pre-processing past transaction data, the 
past transaction data including values for a plurality of 
transaction variables for a plurality of past transactions, 
the consumer data including values for each consumer 
for a plurality of consumer variables; 
training the predictive modeling means with the consumer 
profiles and with the past fraud-related variables to 
obtain a predictive model; and 
storing the obtained predictive model in the computer; 
receiving current transaction data for a current trans- 
action of a consumer; 
receiving consumer data associated with the consumer; 
receiving the consumer profile associated with the con- 
sumer; 

pre-processing the obtained current transaction data, con- 
sumer data, and consumer profile to derive current 
fraud-related variables for the current transaction; 

determining the likelihood of fraud in the current trans- 
action by applying the current fraud-related variables to 
the predictive model; and 

outputting from the predictive modeling means an output 
signal indicating the likelihood that the current trans- 
action is fraudulent. 

25. The computer-implemented process of claim 24, 
wherein the generating step comprises the sub steps of: 

receiving past transaction data for a plurality of past 
transactions, the past transaction data providing values 
for a plurality of transaction variables; 

receiving consumer data for each of a plurality of 
consumers, the consumer data providing values for a 
plurality of consumer variables for each consumer; 

pre-processing the past transaction data to derive past 
fraud-related variables wherein at least some of the past 
fraud-related variables are not present in the plurality of 
variables in the past transaction data; and 

generating a consumer profile for each consumer from the 
past fraud-related variables and the received consumer 
data, each consumer profile describing historical spend- 
ing patterns of the consumer. 

26. The computer-implemented process of claim 24, fur- 
ther comprising the step of updating the received consumer 
profile with the received current transaction data. 

27. The computer-implemented process of claim 24, 
wherein the step of training the predictive modeling means 
comprises the substeps of: 

applying the consumer profile and the derived past fraud- 
related variables to the predictive modeling means; 

ranking output data from the predictive modeling means 
as a function of a quality measurement; 

adjusting the predictive modeling means as a function of 
the ranking step; and 
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repeating the applying, ranking, and adjusting steps until 
the quality measurement exceeds a predetermined level 
indicating that the predictive modeling means is 
adequately trained. 

28. The computer-implemented process of claim 27, 
wherein the step of training the neural network comprises 
the substeps of: 

applying the consumer profile and the derived past fraud- 
related variables to the neural network; 

ranking output data from the neural network as a function 
of a quality measurement; 

adjusting the neural network as a function of the ranking 
step; and 

repeating the applying, ranking, and adjusting steps until 
the quality measurement exceeds a predetermined level 
indicating that the neural network is adequately trained. 

29. The computer-implemented process of claim 24, 
wherein the step of training the predictive modeling means 
comprises training a neural network organized as a plurality 
of input processing elements for receiving the plurality of 
data values in the transaction data, a plurality of hidden 
processing elements coupled to the input processing ele- 
ments for processing the transaction data, and a plurality of 
output processing elements coupled to the hidden processing 
elements for outputting the plurality of output values. 

30. The computer-implemented process of claim 29, 
wherein the neural network comprises a plurality of pro- 
cessing elements linked by connections characterized by 
weights, and the step of adjusting the predictive model 
comprises the steps of: 

selecting a subset of the weights to be decayed; and 
decaying the selected subset of weights. 

31. The computer-implemented process of claim 30, 
wherein the substep of selecting a subset of the weights to 
be decayed comprises applying and minimizing a cost 
function including an interlayer gain multiplier which varies 
a decay rate responsive to the location of a weight within the 
network. 

32. The computer-implemented process of claim 31, 
wherein the cost function is of the form: 
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wherein: 

D represents a data set; 

target* represents a target value for element k of the data 
set; 

output* represents a network output for element k of the 
data set; 

g represents the interlayer gain multiplier; 
I represents the relative importance of the complexity 
term; 

W represents a weight set; 

w, represents a value of weight i; and 

c a represents a constant. 

33. The computer-implemented process of claim 24, 
wherein the current transaction data, the consumer profile, 
and the consumer data each comprise a plurality of data 
elements, further comprising the steps of, for at least one of 
the data elements: 
determining a relative contribution value of the data 
element to the output signal indicating the likelihood 
that the current transaction is fraudulent; 
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determining a reason code as a function of the relative 

contribution value; 
retrieving an explanation associated with the determined 

reason code value; and 
out put ting a computer signal indicative of the reason code 

and the explanation. 

34. The computer-implemented process of claim 24, fur- 
ther comprising the steps of: 

monitoring a performance metric of the predictive mod- 
eling means, the performance metric comprising at 
least one of a fraud detection rate measurement and a 
false positive rate measurement; 

comparing the performance metric with a predetermined 
performance level for the performance metric; and 

responsive to the predetermined performance level 
exceeding the performance metric, repeating the step of 
training the predictive modeling means. 

35. The computer-implemented process of claim 24, 
wherein the past fraud-related variables and the current 
fraud-related variables each comprise at least: 

transaction dollar amounts of past transactions; 
transaction dates and times of past transactions; 
transaction approvals and declines of past transactions; 
risk groups of past transactions; and 
merchants of past transactions. 

36. In a computer system comprising: 
a computer-readable memory; and 

a neural network stored in the computer readable memory, 
the neural network comprising a plurality of intercon- 
nected processing elements, each processing element 
being in a layer of the neural network, each layer 
having a distance to an input layer, each processing 
element comprising: 

a plurality of inputs (x); 

a plurality of weights (w), each weight w associated with 
a corresponding input (x) to form weighted inputs; 

a summation function for combining the weighted inputs; 
and, 

a transfer function for processing the combined weighted 

inputs into an output (z); 
an improved computer-implemented process for training 
the neural network characterized by: 
iteratively decaying the weights of at least one process- 
ing element by a cost function that varies a decay rate 
for decaying the weights by a function of the dis- 
tance of the input layer from the layer containing the 
processing element. 

37. The computer-implemented process of claim 36, 
wherein the cost function is of the form: 



-j-^ (target*- 



output*)* + gK X w ( Cl ot - 1 + ) 



wherein: 

D represents a data set; 

target* represents a target value for an element k of the 
data set; 

output* represents a neural network output for element k 
of the data set; 



15 



20 



25 



35 



40 



50 



60 



g represents an interlayer gain multiplier that varies as a 
function of the distance between the input layer and the 
layer containing the processing element; 

1 represents the relative importance of the decay rate term; 

W represents a weight set; 

w- represents a value of weight i; and 

c 2 represents a constant. 

38. In a computer-controlled transaction processing sys- 
tem including predictive modeling means for receiving 
current transaction data, processing the current transaction 
data, and outputting a plurality of output values, including a 
score value representing a likelihood of a fraudulent 
transaction, an improvement for identifying and determining 
fraudulent transaction data, comprising: 

a model development component for developing a pre- 
dictive model, comprising: 

means for receiving past transaction data for a plurality 
of past transactions, the past transaction data provid- 
ing values for a plurality of transaction variables; 

means for receiving consumer data for each of a 
plurality of consumers, the consumer data providing 
values for a plurality of consumer variables for each 
consumer; 

means for pre-processing the past transaction data to 
derive past fraud-related variables wherein at least 
some of the past fraud-related variables are not 
present in the plurality of variables in the past 
transaction data; 

means for generating a consumer profile for each 
individual consumer, from the past fraud-related 
variables and the received consumer data, the con- 
sumer profile describing historical spending patterns 
of the consumer; 

means for training the predictive model with the con- 
sumer profiles and with the past fraud-related vari- 
ables; and 

means for storing the trained predictive model in the 
computer; and 
a model application component, for applying the trained 
predictive model, comprising: 

means for receiving current transaction date for a 

transaction of a consumer; 
means for receiving consumer data associated with the 

consumer; 

means for receiving the consumer profile associated 
with the consumer; 

a current transaction data pre-processor, for pre- 
processing the obtained current transaction data, 
consumer data, and consumer profile to derive cur- 
rent fraud-related variables for the current transac- 
tion; 

means for determining the likelihood of fraud in the 
current transaction by applying the current fraud- 
related variables to the predictive model; and 
means for outputting from the predictive model an 
output signal indicating the likelihood that the cur- 
rent transaction is fraudulent. 
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